Anchor

Description

Anchor is a backdoor family used alongside the TrickBot botnet against selected high profile targets since at least 2018, and researchers consider it a more selective tool deployed onto already compromised networks.

Stats

First seen: May 2022
Last seen: October 2026

Also known as

AnchorBotAnchorbot

MITRE ATT&CK techniques

20 techniques across 7 tactics.

TA0002 Execution

T1053Scheduled Task/Job
- T1053.005Scheduled Task
- T1053.003Cron
T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell
- T1059.004Unix Shell
T1569System Services
- T1569.002Service Execution

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing
T1070Indicator Removal
- T1070.004File Deletion
T1480Execution Guardrails
T1564Hide Artifacts
- T1564.004NTFS File Attributes

TA0007 Discovery

T1016System Network Configuration Discovery
T1082System Information Discovery

TA0008 Lateral Movement

T1021Remote Services
- T1021.002SMB/Windows Admin Shares

TA0011 Command and Control

T1008Fallback Channels
T1071Application Layer Protocol
- T1071.001Web Protocols
- T1071.004DNS
T1095Non-Application Layer Protocol
T1105Ingress Tool Transfer

TA0112 Defense Impairment

T1553Subvert Trust Controls
- T1553.002Code Signing

Associated groups

G0102Wizard Spider

Alert name variants

Alert Name	Engine
Gen:Variant.Anchor.4	AV
Gen:Variant.Trojan.Anchor.4	AV
Win32.Backdoor.Anchorbot	ATP Sandbox Adv. Heuristics
Win32.Trojan.Anchorbot	ATP Sandbox Adv. Heuristics
Win32.Trojan.AnchorBot	ATP Sandbox Adv. Heuristics
Win64.Backdoor.Anchor	ATP Sandbox Adv. Heuristics
Win64.Trojan.Anchorbot	ATP Sandbox Adv. Heuristics
Win64.Trojan.AnchorBot	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Generic.Anchor.mail.C2.Communication traffic detected	IPS-SWG

Related families

InvisiMole QakBot Cobalt Strike PlugX NETWIRE